TencentOS Server 3: python-pillow (TSSA-2026:1434)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1434 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

BIT-PILLOW-2026-96640 Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearizepagetree in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without tracking duplicate indirect references. When Image.save..., format="PDF", append=True processes an attacker-controlled existing PDF whose...

SUSE CVE-2026-96640

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearizepagetree in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without tracking duplicate indirect references. When Image.save..., format="PDF", append=True processes an attacker-controlled existing PDF whose...

EUVD-2026-107570

Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion...

Linux Distros Unpatched Vulnerability : CVE-2026-96640

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearizepagetree in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without...

CVE-2026-96640

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearizepagetree in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without tracking duplicate indirect references. When Image.save..., format="PDF", append=True processes an attacker-controlled existing PDF whose...

DEBIAN-CVE-2026-96640

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearizepagetree in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without tracking duplicate indirect references. When Image.save..., format="PDF", append=True processes an attacker-controlled existing PDF whose...

CVE-2026-96640 Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearizepagetree in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without tracking duplicate indirect references. When Image.save..., format="PDF", append=True processes an attacker-controlled existing PDF whose...

CVE-2026-96640 Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearizepagetree in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without tracking duplicate indirect references. When Image.save..., format="PDF", append=True processes an attacker-controlled existing PDF whose...

CVE-2026-96640

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearizepagetree in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without tracking duplicate indirect references. When Image.save..., format="PDF", append=True processes an attacker-controlled existing PDF whose...

CVE-2026-96640

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearizepagetree in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without tracking duplicate indirect references. When Image.save..., format="PDF", append=True processes an attacker-controlled existing PDF whose...

CVE-2026-96640 Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearizepagetree in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without tracking duplicate indirect references. When Image.save..., format="PDF", append=True processes an attacker-controlled existing PDF whose...

CVE-2026-96640

The Pillow Python imaging library versions 5.1.0 through 13.0.0 are vulnerable to a resource exhaustion issue in the PdfParser.linearize_page_tree() function located in src/PIL/PdfParser.py . The root cause is that the parser treats a PDF /Pages graph as a tree without tracking duplicate indirect...

Red Hat: CVE-2026-96640: pillow: pillow: Denial of Service via duplicate page references in PDF files

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearizepagetree in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without tracking duplicate indirect references. When Image.save..., format="PDF", append=True processes an attacker-controlled existing PDF whose...

Pillow resource management error vulnerability

Versions of Pillow from 5.1.0 up to but not including 13.0.0 contain a resource management error vulnerability. This vulnerability arises because PdfParser.linearizepagetree in src/PIL/PdfParser.py fails to track repeated indirect references. When processing malicious PDFs that reference the same...